CVE-2021-35503

MediumCVSS 6.1

Published: 05/10/2021(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.71%

49th percentile - higher than 49% of all known CVEs

Summary

Afian FileRun 2021.03.26 is vulnerable to stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs. An attacker can inject malicious JavaScript code.

Risk Assessment

The risk involves arbitrary JavaScript execution in browsers of administrators viewing activity logs, potentially leading to session theft, account takeover, or data exfiltration.

Recommendation

Update Afian FileRun to the latest patched version immediately. Until then, restrict access to activity logs to trusted administrators only.

Original NVD description (English source)

Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.